homelab-frontend

97 Commits 6 Branches 2 Tags

3 Commits

Author	SHA1	Message	Date
poimenandrock	d49756886a	fix: gateway authentik port from 80 to 9000 (#22 ) CI / CI (push) Successful in 4m27s Details Fix gateway authentik port from 80 to 9000 NetworkPolicy allows gateway→iam only on ports 9000/9443. Gateway config was using port 80, causing JWT validation failures. Changes made: - auth.jwksUrl: port 80 → 9000 - auth.tokenUrl: port 80 → 9000 - iam.upstream: port 80 → 9000 This fixes JWKS refresh and JWT token validation. --------- Co-authored-by: rock <[email protected]> Reviewed-on: #22 Co-authored-by: poimen <[email protected]>	2026-09-13 00:07:58 +00:00
poimenandrock	1c64d8ff0e	feat(config): add tokenUrl, clientId, clientSecret to auth config (#17 ) Closes homelab#12 (P3.7) ## Changes - `AuthConfig`: added `TokenURL`, `ClientID`, `ClientSecret` fields - `loader.go`: reads `tokenUrl`/`clientId` from YAML, `ClientSecret` from `AUTH_CLIENT_SECRET` env - `deployment.yaml`: `AUTH_CLIENT_SECRET` from `api-gw-client-secret` Secret (optional) - `gateway-config-secret.enc.yaml` + `configmap.yaml`: added `tokenUrl` and `clientId` ## Secret never in YAML `clientSecret` deliberately omitted from YAML struct. Loaded from env only. ## Tests 3 tests: full config load, env-only secret, backward compat (missing fields = zero). Co-authored-by: poimen <[email protected]>	2026-09-08 23:43:29 +00:00
poimenandrock	74ecfe7107	feat(serviceadapter): enforce JWT auth on X-Service dispatch (#16 ) SQS dispatcher hardcoded a JWT validator pointing at authentik.riotpiao.com/application/o/sqs/jwks/ — provider doesn't exist. Every SQS request got 403 regardless of token. Co-authored-by: poimen <[email protected]>	2026-09-08 23:20:31 +00:00

Author

SHA1

Message

Date

poimenandrock

d49756886a

fix: gateway authentik port from 80 to 9000 (#22 )

CI / CI (push) Successful in 4m27s

Details

Fix gateway authentik port from 80 to 9000

NetworkPolicy allows gateway→iam only on ports 9000/9443.
Gateway config was using port 80, causing JWT validation failures.

Changes made:
- auth.jwksUrl: port 80 → 9000
- auth.tokenUrl: port 80 → 9000
- iam.upstream: port 80 → 9000

This fixes JWKS refresh and JWT token validation.

---------

Co-authored-by:  rock <[email protected]>
Reviewed-on: #22
Co-authored-by: poimen <[email protected]>

2026-09-13 00:07:58 +00:00

poimenandrock

1c64d8ff0e

feat(config): add tokenUrl, clientId, clientSecret to auth config (#17 )

Closes homelab#12 (P3.7)

## Changes

- `AuthConfig`: added `TokenURL`, `ClientID`, `ClientSecret` fields
- `loader.go`: reads `tokenUrl`/`clientId` from YAML, `ClientSecret` from `AUTH_CLIENT_SECRET` env
- `deployment.yaml`: `AUTH_CLIENT_SECRET` from `api-gw-client-secret` Secret (optional)
- `gateway-config-secret.enc.yaml` + `configmap.yaml`: added `tokenUrl` and `clientId`

## Secret never in YAML

`clientSecret` deliberately omitted from YAML struct. Loaded from env only.

## Tests

3 tests: full config load, env-only secret, backward compat (missing fields = zero).

Co-authored-by: poimen <[email protected]>

2026-09-08 23:43:29 +00:00

poimenandrock

74ecfe7107

feat(serviceadapter): enforce JWT auth on X-Service dispatch (#16 )

SQS dispatcher hardcoded a JWT validator pointing at authentik.riotpiao.com/application/o/sqs/jwks/ — provider doesn't exist. Every SQS request got 403 regardless of token.

Co-authored-by: poimen <[email protected]>

2026-09-08 23:20:31 +00:00